LMU Munich Cyberattack Exposes Student IBANs and Emails

Nobody has claimed the attack. Nobody has posted a ransom note or a leak sample. And that is exactly what should worry the students of one of Germany's largest universities, because the dataset the attacker walked away with needs no extortion to be profitable. A name, a university email address, an IBAN and a line saying which degree you are enrolled in is everything a convincing "your semester fee failed" email needs.

Key Takeaways

• LMU Munich identified unauthorized access to its student registration system on September 16, 2026 and says it "must assume that these data were in fact retrieved."
• The affected categories include names, dates of birth, addresses, LMU email addresses, IBANs and account holder names, with health insurance numbers and BAföG numbers possibly affected too.
• LMU has not said how many people are affected; the university has more than 52,000 students, but its FAQ also addresses applicants whose data sat in the same system.
• LMU issued its notice under Article 34 of the GDPR, the provision reserved for breaches likely to cause a high risk to the people concerned.
• No attacker has been named, no ransom demand has been disclosed, and LMU says it has no indication the data has been published or misused so far.

What Happened at LMU Munich?

An unknown attacker gained access to the server that stores student registration master data, and LMU believes the records were copied before the intrusion was stopped. In its official notice dated September 19, 2026, the University Executive Board wrote that "an unauthorized actor gained access to standing data relating to student registrations stored in an LMU IT system." The university says it prevented any modification of the data and that the records remain available to LMU.

The timeline, per LMU's incident FAQ:

• September 16: the incident is identified and the affected system is shut down. LMU "cannot provide any definitive information" on when the intrusion began or how long it lasted.
• September 19: LMU publishes its GDPR notice and FAQ, noting that certain unaffected systems were also taken offline as a precaution.
• September 20: LMU confirms that "passwords and the LMU user IDs have not been compromised" and that no system other than the enrollment system was breached. Restoring the Online Course Catalogue (LSF) is a priority.
• September 22: enrollment reopens on a newly built system, with deadlines extended.

LMU is running the forensic investigation in close cooperation with the Bavarian State Criminal Police Office. The Record reports that the attacker has not been identified and that the university has not said whether it received a ransom demand.

What Data Did the Attacker Get?

LMU's own list covers most of what a student hands over at registration. The university states that the following categories are affected "insofar as such information was provided in the course of registration":

• Identity: name, date of birth, gender, and in some cases place or country of birth
• Contact: term time and home address, in some cases a phone number, the LMU email address, and in some cases further email addresses
• Banking: IBAN and name of account holder
• May be affected: health insurance numbers, BAföG numbers (Germany's federal student financial aid), course of study, previous school and academic qualifications
• Individual cases: information relevant to reasons for leaves of absence, which LMU classifies as special category data under Article 9 of the GDPR

Exam records, course content and individual academic performance are "expressly not affected." heise online summarized it bluntly: the complete enrollment datasets "have apparently been copied."

How Many People Are Affected?

Nobody knows yet, and the widely repeated 52,000 figure is LMU's total enrollment, not a confirmed victim count. LMU's FAQ says: "At this time, we cannot provide reliable estimates of the total number of people, data volume, or periods affected."

The real figure could land on either side of it. The FAQ includes a block of answers "intended primarily for applicants and other individuals whose data were processed in the affected system," which suggests the exposure reaches beyond currently enrolled students. If the registration database retained records of past cohorts and rejected applicants, the affected population could be several times larger than the current student body. LMU has not confirmed any retention period, so treat that as an open question.

Why Is Enrollment Data a Phishing Kit?

Enrollment records hand an attacker what a targeted phishing email needs most: a verified inbox plus enough personal detail to prove "we know who you are." heise made the same point, noting that LMU's notice "does not explicitly mention the specific attack scenario of (spear-)phishing" even though the danger "is very real."

Consider the pretexts this dataset unlocks:

• Semester fee and enrollment emails: sent to the student's LMU address, addressed by full name, citing their actual degree program.
• BAföG messages: a fake notice about a payment or a missing document, quoting the student's real BAföG number.
• Health insurance messages: a fake insurer letter quoting the real insurance number.
• Bank verification lures: "confirm your IBAN ending in..." messages that are more convincing because the attacker already has the full number.

Timing makes it worse. According to heise, the winter semester starts October 12, so new and returning students are expecting mail about fees and enrollment certificates right now. LMU's own FAQ is currently telling students where to find semester fee payment information. A phishing email that arrives this month does not look out of place.

The IBAN adds a second, quieter risk. In the SEPA system, a creditor pulls money from an account under a mandate, and a fraudster with a name and IBAN can try to set up direct debits against it. The Deutsche Bundesbank notes that a SEPA core direct debit "can be returned within eight weeks after the account has been debited," and for a collection without a valid mandate the payer "can demand a refund of the debited amount within 13 months." Those windows only help if someone is looking at the statement. We saw the same exposure when Basic-Fit lost 1 million gym members' bank details earlier this year.

What This Means for Your Inbox

This breach will play out in email. LMU says passwords and user IDs were not compromised, which means the attacker cannot log in to student accounts with what was stolen. The obvious next step for anyone who wants those accounts, or the bank accounts behind them, is to ask the students for credentials directly, by email.

Two details in LMU's list widen the target. First, the LMU address is a verified, active inbox tied to a real name, and students are used to trusting mail that arrives there. Second, the notice lists "further email addresses" in some cases. For many students that is a personal Gmail or Outlook account, so the lures will not stay on university servers. Anyone who registered with a private address should expect LMU themed messages there too.

The university sector keeps producing these datasets. This summer, ShinyHunters stole data on 454,600 University of Nottingham students, and Mount Royal University faced a $1.9M ransom demand. LMU differs in one respect: no group has claimed it. Most coverage treats that as reassuring. It is not. heise observed that the incident does not look like a typical ransomware attack, and an attacker who never goes public can sell or use the data without triggering the leak site monitoring LMU has set up.

What Should LMU Students and Applicants Do Now?

Assume your registration data is in someone else's hands and act on the bank and inbox sides today. LMU's own advice, drawn from its notice, is to inspect attachments and links carefully, be wary of approaches that reference LMU or your studies, and "not disclose any bank details or passwords." Building on that:

1. Check your bank account weekly for direct debits from creditors you do not recognize, and return them. The eight week return window runs from the day the account was debited.
2. Never act on an LMU, BAföG or insurance email from a link. Type the portal address yourself or use a bookmark.
3. Treat any message quoting your IBAN, insurance number or BAföG number as suspicious, not as proof of legitimacy. That data is now exactly what an attacker would quote.
4. Turn on two factor authentication on the personal email address you gave LMU, since it may be on the list too.
5. Ask LMU directly whether your record is affected and how far back the database goes, at cybersicherheit@lmu.de. The BSI (Germany's Federal Office for Information Security) publishes further guidance on fraud attempts.

The Compliance Angle: GDPR Articles 33 and 34

LMU's notice opens with the words "In accordance with Article 34 of the GDPR," and that choice is itself a risk assessment. As the European Data Protection Board explains, a controller must notify its data protection authority within 72 hours unless the breach is unlikely to result in a risk, and must tell the affected people directly only when the breach "is likely to result in a high risk to the rights and freedoms of the natural person." By invoking Article 34, LMU has effectively conceded the high risk threshold.

LMU says it has coordinated "with the relevant supervisory and law enforcement authorities since the incident became known." For Bavarian public bodies, the supervisory authority is the Bavarian Data Protection Commissioner (BayLfD), not the BayLDA, which oversees private companies.

The speed stands out. LMU went from detection on September 16 to a public notice on September 19, three days. Compare that with Kaplan, which took four months to notify 230,000 people. For compliance teams at other universities, the lesson is less about LMU's response than its exposure: a registration system that stores IBANs, insurance numbers and leave of absence reasons in one place is a single point of failure. Separating Article 9 data from routine registration fields, and enforcing a documented retention limit for applicant records, would each shrink the blast radius of the next intrusion.

What to Watch Next

How bad this gets depends mostly on two open questions. How many people, going back how many years, sit in that registration database? And will the dataset ever surface on a criminal forum? LMU has promised in its FAQ to notify affected individuals "without delay" if monitoring finds the data published or misused. Until then, the safest assumption for anyone who ever registered at LMU is that the next email mentioning their studies could be the attacker's.